Re: Using systemd-249's libnss_systemd.so.2 triggers a crash in bash-5.1's malloc.c

[Andreas Schwab]

On Okt 04 2021, Julien Moutinho wrote:

> - bash crashes inside valgrind too,
>   but apparently something different is happening
>   because it crashes even without systemd being involved:
>
> $ nix build .#bash5-with-bash-malloc
> $ valgrind result/bin/bash --norc -c true
>> ==307088== Memcheck, a memory error detector
>> ==307088== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
>> ==307088== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
>> ==307088== Command: result/bin/bash --norc -c true
>> ==307088== 
>> ==307088== Invalid free() / delete / delete[] / realloc()
>> ==307088==    at 0x483F8E9: free (in 
>> /nix/store/7s7hzqaf5imxmpjlxh2n6fs7ixml98ya-valgrind-3.16.1/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
>> ==307088==    by 0x47330F: xfree (xmalloc.c:150)
>> ==307088==    by 0x4644FA: unwind_frame_run_internal (unwind_prot.c:325)
>> ==307088==    by 0x4640B6: without_interrupts (unwind_prot.c:117)
>> ==307088==    by 0x464656: run_unwind_frame (unwind_prot.c:143)
>> ==307088==    by 0x479ACA: parse_and_execute (evalstring.c:523)
>> ==307088==    by 0x41C0A5: run_one_command (shell.c:1440)
>> ==307088==    by 0x41D6A1: main (shell.c:741)
>> ==307088==  Address 0x404be10 is in the brk data segment 0x4033000-0x4054fff

Here is a patch:

diff --git i/builtins/evalstring.c w/builtins/evalstring.c
index 18928a17..ae684d26 100644
--- i/builtins/evalstring.c
+++ w/builtins/evalstring.c
@@ -197,6 +197,12 @@ parse_and_execute_cleanup (old_running_trap)
     parse_and_execute_level = 0;                       /* XXX */
 }
 
+static void
+free_string (char *string)
+{
+  xfree (string);
+}
+
 static void
 parse_prologue (string, flags, tag)
      char *string;
@@ -247,7 +253,7 @@ parse_prologue (string, flags, tag)
     add_unwind_protect (parser_restore_alias, (char *)NULL);
 
   if (orig_string && ((flags & SEVAL_NOFREE) == 0))
-    add_unwind_protect (xfree, orig_string);
+    add_unwind_protect (free_string, orig_string);
   end_unwind_frame ();
 
   if (flags & (SEVAL_NONINT|SEVAL_INTERACT))

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."